arrayrange - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-10-07
Category
Administrator Guide
Abstract

Learn more about the Cortex Query Language arrayrange() function that returns a portion of an array based on specified array indices.

Syntax
arrayrange (<array>, <start>, <end>)
Description

The arrayrange() function returns a portion, or a slice, of an array given a start and end range. Indices are 0-based, and the start range is inclusive, but the end range is exclusive.

Example

So if you have an array:

[0,1,2,3,4,5,6]

and you specify:

arrayrange(<array>, 2, 4)

the function will return:

[2,3]

If you specify an end index that is higher than the last element in the array, the resulting array contains the starting element to the end of the array.

arrayrange(<array>, 2, 8)

the function will return:

[2,3,4,5,6]